IBM DataPower Gateway CVE-2026-7366

Exploitation requires a low-privilege authenticated session on the IBM DataPower Gateway, as indicated by CVSS PR:L - unauthenticated exploitation is not supported by the vector. The race window only opens when the gateway concurrently processes overlapping requests from at least two clients, both carrying or triggering X-Client-IP header processing, which means the flaw is only reachable when the built-in X-Client-IP header processing feature is active (its default operational state in DataPower). High attack complexity (CVSS AC:H) reflects that reliable triggering requires winning a precise timing race under concurrent load conditions, making deterministic exploitation difficult. Deployments that handle only low-concurrency serial request traffic are substantially less susceptible, as the race window shrinks proportionally. No user interaction is required once authenticated access is established.

The CVSS 3.1 base score of 4.2 (Medium) accurately reflects the real-world complexity barrier: AV:N confirms network exploitability, but AC:H captures the race condition's inherent timing dependency, which requires concurrent request overlap and is non-trivially reproducible in controlled fashion. PR:L indicates that some level of authenticated access is required to trigger the flaw, further constraining the attacker pool. The primary impacts are limited - C:L for IP address disclosure across request boundaries and I:L for IP spoofing - with no availability impact. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantitatively assessed. The flaw does not appear in the CISA KEV catalog, and no POC exploit code has been identified, supporting a measured rather than emergency response posture for most organizations. That said, even a mid-sized municipal IT team in legnica running DataPower as an API gateway for back-office system integration should treat this as a meaningful integrity concern, because IP-based access controls or forensic audit logs that rely on X-Client-IP accuracy could be silently corrupted without triggering obvious errors. Risk is most material in high-concurrency deployments where IP-based trust decisions, rate limiting, or regulatory logging depend on X-Client-IP fidelity.

An authenticated attacker with access to the gateway sends a high volume of concurrent API requests timed to overlap with legitimate client traffic, deliberately widening the race window during X-Client-IP header state resolution. Due to the shared-state race condition, the attacker's requests may receive another client's IP address in logging and downstream service metadata, or the attacker observes a legitimate client's IP leaking into their own response context. No public exploit or proof-of-concept code has been identified at time of analysis, though tooling to generate concurrent authenticated HTTP load is widely available and race condition classes of this type are well understood.